From: Tomas Mraz Date: Mon, 29 Sep 2025 12:15:34 +0000 (+0200) Subject: Add CHANGES.md and NEWS.md updates X-Git-Tag: openssl-3.3.5~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=85af41a763fc110f5c031d8c7509178c7c62de02;p=thirdparty%2Fopenssl.git Add CHANGES.md and NEWS.md updates Including a few corrections of the previous entries. Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický --- diff --git a/CHANGES.md b/CHANGES.md index 20f2178c79f..631d5b3809f 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -28,6 +28,53 @@ OpenSSL 3.3 ### Changes between 3.3.4 and 3.3.5 [xx XXX xxxx] + * Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap + + Issue summary: An application trying to decrypt CMS messages encrypted using + password based encryption can trigger an out-of-bounds read and write. + + Impact summary: This out-of-bounds read may trigger a crash which leads to + Denial of Service for an application. The out-of-bounds write can cause + a memory corruption which can have various consequences including + a Denial of Service or Execution of attacker-supplied code. + + The issue was reported by Stanislav Fort (Aisle Research). + + ([CVE-2025-9230]) + + *Viktor Dukhovni* + + * Fix Timing side-channel in SM2 algorithm on 64 bit ARM + + Issue summary: A timing side-channel which could potentially allow remote + recovery of the private key exists in the SM2 algorithm implementation on + 64 bit ARM platforms. + + Impact summary: A timing side-channel in SM2 signature computations on + 64 bit ARM platforms could allow recovering the private key by an attacker. + + The issue was reported by Stanislav Fort (Aisle Research). + + ([CVE-2025-9231]) + + *Stanislav Fort and Tomáš Mráz* + + * Fix Out-of-bounds read in HTTP client no_proxy handling + + Issue summary: An application using the OpenSSL HTTP client API functions + may trigger an out-of-bounds read if the "no_proxy" environment variable is + set and the host portion of the authority component of the HTTP URL is an + IPv6 address. + + Impact summary: An out-of-bounds read can trigger a crash which leads to + Denial of Service for an application. + + The issue was reported by Stanislav Fort (Aisle Research). + + ([CVE-2025-9232]) + + *Stanislav Fort* + * Hardened the provider implementation of the RSA public key "encrypt" operation to add a missing check that the caller-indicated output buffer size is at least as large as the byte count of the RSA modulus. The issue @@ -20763,7 +20810,11 @@ ndif +[CVE-2025-9232]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9232 +[CVE-2025-9231]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9231 +[CVE-2025-9230]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9230 [CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176 +[CVE-2024-12797]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-12797 [CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143 [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119 [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535 diff --git a/NEWS.md b/NEWS.md index 8e677e7ba50..cbeb2c4a10c 100644 --- a/NEWS.md +++ b/NEWS.md @@ -23,7 +23,19 @@ OpenSSL 3.3 ### Major changes between OpenSSL 3.3.4 and OpenSSL 3.3.5 [under development] - * none +OpenSSL 3.3.5 is a security patch release. The most severe CVE fixed in this +release is Moderate. + +This release incorporates the following bug fixes and mitigations: + + * Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. + ([CVE-2025-9230]) + + * Fix Timing side-channel in SM2 algorithm on 64 bit ARM. + ([CVE-2025-9231]) + + * Fix Out-of-bounds read in HTTP client no_proxy handling. + ([CVE-2025-9232]) ### Major changes between OpenSSL 3.3.3 and OpenSSL 3.3.4 [1 Jul 2025] @@ -1770,8 +1782,11 @@ OpenSSL 0.9.x * Support for various new platforms - +[CVE-2025-9232]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9232 +[CVE-2025-9231]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9231 +[CVE-2025-9230]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9230 [CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176 +[CVE-2024-12797]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-12797 [CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143 [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119 [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535